PT-2013-1244 · Libraw+1 · Libraw+1

Raphael Geissert · Publicado 2013-09-15 · Atualizado 2014-02-10 · CVE-2013-1439

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libraw versions 0.13.x through 0.15.3 libraw version 0.15.x before 0.15.4

Description The issue affects the "faster LJPEG decoder" in libraw, allowing context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file. This can lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation can be done remotely.

Recommendations For libraw versions 0.13.x through 0.15.3, update to version 0.15.4 or later. For libraw version 0.15.x before 0.15.4, update to version 0.15.4 or later.

Exploit

Correção

Identificadores relacionados

ALT-PU-2014-1073

BDU:2015-09729

CVE-2013-1439

MGASA-2013-0301

MGASA-2013-0385

MGASA-2014-0050

USN-1964-1

USN-1978-1

Produtos afetados

Alt Linux

Libraw

Referências · 27

• 🔥 https://github.com/LibRaw/LibRaw/commit/11909cc59e712e09b508dda729b99aeaac2b29ad · Exploit
• 🔥 http://openwall.com/lists/oss-security/2013/08/29/3 · Exploit
• https://github.com/LibRaw/LibRaw/commit/19ffddb0fe1a4ffdb459b797ffcf7f490d28b5a6 · Nota
• https://github.com/LibRaw/LibRaw/commit/2f912f5b33582961b1cdbd9fd828589f8b78f21d · Nota
• https://ubuntu.com/security/notices/USN-1978-1 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0050.html · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2013-1439 · Aviso do Fabricante
• http://ubuntu.com/usn/usn-1964-1 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1439 · Aviso do Fabricante
• http://ubuntu.com/usn/usn-1978-1 · Nota
• https://ubuntu.com/security/CVE-2013-1439 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-201309-09.xml · Nota
• https://bdu.fstec.ru/vul/2015-09729 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-1439 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2013-0385 · Aviso do Fabricante